Skip to content

Commit

Permalink
fix: set image_type, machine_type, and sandboxing on default node poo…
Browse files Browse the repository at this point in the history 
…l to comply with validation policies (#1038)
  • Loading branch information
@MajorBreakfast
MajorBreakfast committed Oct 29, 2021
1 parent bb86214 commit 8e92f6e
Show file tree
Hide file tree
Showing 8 changed files with 118 additions and 8 deletions.
24 changes: 23 additions & 1 deletion autogen/main/cluster.tf.tmpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -252,6 +252,13 @@ resource "google_container_cluster" "primary" {
initial_node_count = var.initial_node_count

node_config {
{% if beta_cluster %}
image_type = lookup(var.node_pools[0], "image_type", lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled) ? "COS_CONTAINERD" : "COS")
{% else %}
image_type = lookup(var.node_pools[0], "image_type", "COS")
{% endif %}
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")

service_account = lookup(var.node_pools[0], "service_account", local.service_account)

dynamic "workload_metadata_config" {
Expand All @@ -263,6 +270,22 @@ resource "google_container_cluster" "primary" {
}

metadata = local.node_pools_metadata["all"]

{% if beta_cluster %}
dynamic "sandbox_config" {
for_each = tobool((lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled))) ? ["gvisor"] : []
content {
sandbox_type = sandbox_config.value
}
}

boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", "")
{% endif %}

shielded_instance_config {
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)
enable_integrity_monitoring = lookup(var.node_pools[0], "enable_integrity_monitoring", true)
}
}
}

Expand Down Expand Up @@ -635,4 +658,3 @@ resource "google_container_node_pool" "pools" {
delete = "45m"
}
}

10 changes: 9 additions & 1 deletion cluster.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,9 @@ resource "google_container_cluster" "primary" {
initial_node_count = var.initial_node_count

node_config {
image_type = lookup(var.node_pools[0], "image_type", "COS")
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")

service_account = lookup(var.node_pools[0], "service_account", local.service_account)

dynamic "workload_metadata_config" {
Expand All @@ -149,6 +152,12 @@ resource "google_container_cluster" "primary" {
}

metadata = local.node_pools_metadata["all"]


shielded_instance_config {
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)
enable_integrity_monitoring = lookup(var.node_pools[0], "enable_integrity_monitoring", true)
}
}
}

Expand Down Expand Up @@ -330,4 +339,3 @@ resource "google_container_node_pool" "pools" {
delete = "45m"
}
}

18 changes: 17 additions & 1 deletion modules/beta-private-cluster-update-variant/cluster.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -225,6 +225,9 @@ resource "google_container_cluster" "primary" {
initial_node_count = var.initial_node_count

node_config {
image_type = lookup(var.node_pools[0], "image_type", lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled) ? "COS_CONTAINERD" : "COS")
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")

service_account = lookup(var.node_pools[0], "service_account", local.service_account)

dynamic "workload_metadata_config" {
Expand All @@ -236,6 +239,20 @@ resource "google_container_cluster" "primary" {
}

metadata = local.node_pools_metadata["all"]

dynamic "sandbox_config" {
for_each = tobool((lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled))) ? ["gvisor"] : []
content {
sandbox_type = sandbox_config.value
}
}

boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)
enable_integrity_monitoring = lookup(var.node_pools[0], "enable_integrity_monitoring", true)
}
}
}

Expand Down Expand Up @@ -578,4 +595,3 @@ resource "google_container_node_pool" "pools" {
delete = "45m"
}
}

18 changes: 17 additions & 1 deletion modules/beta-private-cluster/cluster.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -225,6 +225,9 @@ resource "google_container_cluster" "primary" {
initial_node_count = var.initial_node_count

node_config {
image_type = lookup(var.node_pools[0], "image_type", lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled) ? "COS_CONTAINERD" : "COS")
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")

service_account = lookup(var.node_pools[0], "service_account", local.service_account)

dynamic "workload_metadata_config" {
Expand All @@ -236,6 +239,20 @@ resource "google_container_cluster" "primary" {
}

metadata = local.node_pools_metadata["all"]

dynamic "sandbox_config" {
for_each = tobool((lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled))) ? ["gvisor"] : []
content {
sandbox_type = sandbox_config.value
}
}

boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)
enable_integrity_monitoring = lookup(var.node_pools[0], "enable_integrity_monitoring", true)
}
}
}

Expand Down Expand Up @@ -493,4 +510,3 @@ resource "google_container_node_pool" "pools" {
delete = "45m"
}
}

18 changes: 17 additions & 1 deletion modules/beta-public-cluster-update-variant/cluster.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -225,6 +225,9 @@ resource "google_container_cluster" "primary" {
initial_node_count = var.initial_node_count

node_config {
image_type = lookup(var.node_pools[0], "image_type", lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled) ? "COS_CONTAINERD" : "COS")
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")

service_account = lookup(var.node_pools[0], "service_account", local.service_account)

dynamic "workload_metadata_config" {
Expand All @@ -236,6 +239,20 @@ resource "google_container_cluster" "primary" {
}

metadata = local.node_pools_metadata["all"]

dynamic "sandbox_config" {
for_each = tobool((lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled))) ? ["gvisor"] : []
content {
sandbox_type = sandbox_config.value
}
}

boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)
enable_integrity_monitoring = lookup(var.node_pools[0], "enable_integrity_monitoring", true)
}
}
}

Expand Down Expand Up @@ -559,4 +576,3 @@ resource "google_container_node_pool" "pools" {
delete = "45m"
}
}

18 changes: 17 additions & 1 deletion modules/beta-public-cluster/cluster.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -225,6 +225,9 @@ resource "google_container_cluster" "primary" {
initial_node_count = var.initial_node_count

node_config {
image_type = lookup(var.node_pools[0], "image_type", lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled) ? "COS_CONTAINERD" : "COS")
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")

service_account = lookup(var.node_pools[0], "service_account", local.service_account)

dynamic "workload_metadata_config" {
Expand All @@ -236,6 +239,20 @@ resource "google_container_cluster" "primary" {
}

metadata = local.node_pools_metadata["all"]

dynamic "sandbox_config" {
for_each = tobool((lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled))) ? ["gvisor"] : []
content {
sandbox_type = sandbox_config.value
}
}

boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)
enable_integrity_monitoring = lookup(var.node_pools[0], "enable_integrity_monitoring", true)
}
}
}

Expand Down Expand Up @@ -474,4 +491,3 @@ resource "google_container_node_pool" "pools" {
delete = "45m"
}
}

10 changes: 9 additions & 1 deletion modules/private-cluster-update-variant/cluster.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,9 @@ resource "google_container_cluster" "primary" {
initial_node_count = var.initial_node_count

node_config {
image_type = lookup(var.node_pools[0], "image_type", "COS")
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")

service_account = lookup(var.node_pools[0], "service_account", local.service_account)

dynamic "workload_metadata_config" {
Expand All @@ -149,6 +152,12 @@ resource "google_container_cluster" "primary" {
}

metadata = local.node_pools_metadata["all"]


shielded_instance_config {
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)
enable_integrity_monitoring = lookup(var.node_pools[0], "enable_integrity_monitoring", true)
}
}
}

Expand Down Expand Up @@ -428,4 +437,3 @@ resource "google_container_node_pool" "pools" {
delete = "45m"
}
}

10 changes: 9 additions & 1 deletion modules/private-cluster/cluster.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,9 @@ resource "google_container_cluster" "primary" {
initial_node_count = var.initial_node_count

node_config {
image_type = lookup(var.node_pools[0], "image_type", "COS")
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")

service_account = lookup(var.node_pools[0], "service_account", local.service_account)

dynamic "workload_metadata_config" {
Expand All @@ -149,6 +152,12 @@ resource "google_container_cluster" "primary" {
}

metadata = local.node_pools_metadata["all"]


shielded_instance_config {
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)
enable_integrity_monitoring = lookup(var.node_pools[0], "enable_integrity_monitoring", true)
}
}
}

Expand Down Expand Up @@ -343,4 +352,3 @@ resource "google_container_node_pool" "pools" {
delete = "45m"
}
}

0 comments on commit 8e92f6e

Please sign in to comment.